14621 matches found
WP MapIt < 3.0.0 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its wpmapit shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Custom My Account for Woocommerce <= 2.1 - Stored XSS via CSRF
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
Forminator < 1.28.0 - Admin+ Arbitrary File Upload
Description The plugin does not properly blacklist files via the forminatorallowedmimetypes function, which could allow administrator to upload arbitrary file. However, RCE can not be achieved due to htaccess configuration...
SendPress Newsletters < 1.23.11.6 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Responsive Column Widgets <= 1.2.7 - Reflected XSS
Description The plugin does not sanitise and escape the tab parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WP Crowdfunding < 2.1.7 - Reflected XSS
Description The plugin does not sanitise and escape the postid parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
SendPress Newsletters <= 1.23.11.6 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Seriously Simple Stats < 1.5.1 - Podcast Manager+ SQLi
Description The plugin does not properly sanitise and escape the orderby parameter before using it in a SQL statement, leading to a SQL injection exploitable by podcast manager roles and above...
Photo Feed <= 2.2.1 - Reflected XSS
Description The plugin does not sanitise and escape the pf-gid parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Restrict Categories <= 2.6.4 - Reflected XSS
Description The plugin does not sanitise and escape the rc-search parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Atarim < 3.13 - Unauthenticated Stored XSS
Description The plugin does not validate and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...
Auto Login New User After Registration <= 1.9.6 - Stored XSS via CSRF
Description The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
Auto Affiliate Links < 6.4.2.5 - Settings Update to Stored XSS via CSRF
Description The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
Category Post List Widget <= 2.0 - Settings Update to Stored XSS via CSRF
Description The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
Products, Order & Customers Export for WooCommerce <= 2.0.10 - Reflected XSS
Description The plugin does not sanitise and escape various parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Shortcodes Finder < 1.5.4 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WP Project Manager < 2.6.1 - Subscriber+ SQLi
Description The plugin does not properly sanitise and escape the user task starting date parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber...
MStore API < 4.0.7 - Subscriber+ SQLi
Description The plugin does not properly sanitise and escape some parameters before using them in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...
WP Not Login Hide <= 1.0 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Visit the "WPNLH" interface...
Qi Addons For Elementor < 1.6.5 - Contributor+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Webpushr < 4.35.0 - LFI via CSRF
Description The plugin does not have CSRF check in its wppsavesettings function, and does not validate the menu parameter, allowing attackers to make logged in users admins perform LFI attacks via CSRF...
Advanced Page Visit Counter < 8.0.1 - Contributor+ SQLi
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by Contributor and above users...
WP Event Manager < 3.1.43 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Contact Form Email < 1.3.44 - Editor+ Stored Cross-Site Scripting
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Create a form and navigate to...
Video Gallery – YouTube Gallery <= 2.2.1 - Admin+ SQLi
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
YOP Poll < 6.5.27 - Unauthenticated Vote Manipulation via Race Condition
Description The plugin is affected by a race condition, allowing unauthenticated users to vote multiple times on a poll even when it's configured to only allow one vote per person...
WooCommerce - Store Exporter < 2.7.2.1 - Reflected XSS
Description The plugin does not sanitise and escape the filter parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
User Avatar < 1.4.12 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WP Google My Business Auto Publish < 3.8 - Multiple CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins delete transients and update post metadata via CSRF attacks...
WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. PoC 1. Visit WP Fastest Cache Settings. Ensure "Cache System" is enabled, and "Logged-in Users" is disabled. Click "Submit"...
Contact Forms by Cimatti < 1.6.1 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
BSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape the insertedcount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open the URL below...
Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG
Description The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC As an author, upload an SVG file with malicious JavaScript: Access the file through its URL to see XSS...
Popup box < 3.8.6 - Admin+ Stored XSS in Popup Settings
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Add a new Popup 2. In the...
PowerPress Podcasting < 11.0.7 - Contributor+ SSRF
Description The plugin does not validate a parameter before making a request to it via the powerpressmediainfo AJAX action, which could allow Contributor and above role to perform SSRF attacks...
AMP+ Plus <= 3.0 - Reflected Cross Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC https://example.com/?p=1=%22%3E%3CScRiPt%3Ealert%28%27XSS%27%29%3C%2FsCrIpT%3E...
Simply Excerpts <= 1.4 - Admin+ Stored XSS
Description The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup. PoC Put the following...
Profile Builder < 3.10.4 - Plugins Activation/Deactivation CSRF
Description The plugin does not have CSRF checks when activating and deactivating plugins, which could allow attackers to make logged in users perform such actions via CSRF attacks...
Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF
Description The plugin does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks PoC Make a logged in admin open an HTML page with the form below Deletion This will delete the...
Advanced iFrame < 2023.9 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Church Admin < 3.8.0 - Server-Side Request Forgery (SSRF)
Description Server-Side Request Forgery SSRF vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56...
Autolinks Manager < 1.10.05 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Frontend File Manager < 22.7 - Editor+ Arbitrary File Download
Description The plugin has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as wp-config.php PoC 1 Create new post with this shortcode - ffmwp 2 Go to new post and upload any file 3 After that go to main page of plugin for users...
Filr – Secure document library < 1.2.3.6 - Author+ RCE via file upload with phar ext
Description The plugin is vulnerable from an RCE Remote Code Execution vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges. PoC 1 Go to main dashboard of plugin...
Easy Newsletter Signups <= 1.0.4 - Admin+ SQLi
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin PoC 1. From the "Easy Newsletter Signups", select an email address and then click "Export to CSV" 2. Intercept...
Popup box < 3.8.6 - Admin+ Stored XSS in Categories
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to "Popup Box Categories" 2...
eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF
Description The plugin does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products PoC Make a logged in admin open the URL below...
Word Balloon < 4.20.3 - Avatar Removal via CSRF
Description The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link. PoC Make a logged in admin open https://example.com/wp-admin/options-general.php?page=word-balloon=delet...